A hand-rolled recogniser for IP literals, feeding the internal-range block.

parseIpLiteral turns a host into an IpAddr or Nothing for a DNS name. Its dotted-quad is lenient by design, coercing each octet exactly as inet_aton and hence a libc resolver does, so the policy layer tests the address the proxy would actually dial rather than a decimal misreading. Delegating the recognition to a library would move that boundary, so only range membership goes to iproute, in Ecluse.Core.Security.Host.